Lucene search

K
nessusThis script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.SMB_NT_MS22_JUL_5015814.NASL
HistoryJul 12, 2022 - 12:00 a.m.

KB5015814: Windows 11 Security Update (July 2022)

2022-07-1200:00:00
This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
121
elevation of privilege
security feature bypass
remote code execution
vulnerabilities
windows 11
update
july 2022
nessus scanner

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.702

Percentile

98.0%

The remote Windows host is missing security update 5015814. It is, therefore, affected by multiple vulnerabilities:

  • An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2022-22022, CVE-2022-22026, CVE-2022-22031, CVE-2022-22034, CVE-2022-22036, CVE-2022-22037, CVE-2022-22041, CVE-2022-22045, CVE-2022-22047, CVE-2022-22049, CVE-2022-22050, CVE-2022-30202, CVE-2022-30205, CVE-2022-30206, CVE-2022-30209, CVE-2022-30220, CVE-2022-30224, CVE-2022-30225, CVE-2022-30226)

  • A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.
    (CVE-2022-22023, CVE-2022-22048, CVE-2022-30203)

  • A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. (CVE-2022-22024, CVE-2022-22027, CVE-2022-22038, CVE-2022-30211, CVE-2022-30221, CVE-2022-30222)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(163041);
  script_version("1.12");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/06/17");

  script_cve_id(
    "CVE-2022-21845",
    "CVE-2022-22022",
    "CVE-2022-22023",
    "CVE-2022-22024",
    "CVE-2022-22025",
    "CVE-2022-22026",
    "CVE-2022-22027",
    "CVE-2022-22031",
    "CVE-2022-22034",
    "CVE-2022-22036",
    "CVE-2022-22037",
    "CVE-2022-22038",
    "CVE-2022-22040",
    "CVE-2022-22041",
    "CVE-2022-22042",
    "CVE-2022-22043",
    "CVE-2022-22045",
    "CVE-2022-22047",
    "CVE-2022-22048",
    "CVE-2022-22049",
    "CVE-2022-22050",
    "CVE-2022-22711",
    "CVE-2022-27776",
    "CVE-2022-30202",
    "CVE-2022-30203",
    "CVE-2022-30205",
    "CVE-2022-30206",
    "CVE-2022-30208",
    "CVE-2022-30209",
    "CVE-2022-30211",
    "CVE-2022-30212",
    "CVE-2022-30213",
    "CVE-2022-30216",
    "CVE-2022-30220",
    "CVE-2022-30221",
    "CVE-2022-30222",
    "CVE-2022-30223",
    "CVE-2022-30224",
    "CVE-2022-30225",
    "CVE-2022-30226"
  );
  script_xref(name:"MSKB", value:"5015814");
  script_xref(name:"MSFT", value:"MS22-5015814");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/08/02");
  script_xref(name:"IAVA", value:"2022-A-0272-S");
  script_xref(name:"IAVA", value:"2022-A-0273-S");
  script_xref(name:"CEA-ID", value:"CEA-2022-0026");

  script_name(english:"KB5015814: Windows 11 Security Update (July 2022)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host is missing security update 5015814. It is, therefore, affected by multiple vulnerabilities:
  
  - An elevation of privilege vulnerability. An attacker can
    exploit this to gain elevated privileges.
    (CVE-2022-22022, CVE-2022-22026, CVE-2022-22031,
    CVE-2022-22034, CVE-2022-22036, CVE-2022-22037,
    CVE-2022-22041, CVE-2022-22045, CVE-2022-22047,
    CVE-2022-22049, CVE-2022-22050, CVE-2022-30202,
    CVE-2022-30205, CVE-2022-30206, CVE-2022-30209,
    CVE-2022-30220, CVE-2022-30224, CVE-2022-30225,
    CVE-2022-30226)

  - A security feature bypass vulnerability exists. An
    attacker can exploit this and bypass the security
    feature and perform unauthorized actions compromising
    the integrity of the system/application.
    (CVE-2022-22023, CVE-2022-22048, CVE-2022-30203)

  - A remote code execution vulnerability. An attacker can
    exploit this to bypass authentication and execute
    unauthorized arbitrary commands. (CVE-2022-22024,
    CVE-2022-22027, CVE-2022-22038, CVE-2022-30211,
    CVE-2022-30221, CVE-2022-30222)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/en-us/help/5015814");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5015814");
  script_set_attribute(attribute:"solution", value:
"Apply Security Update 5015814");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-22041");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2022-30221");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/05/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/07/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/07/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows_11_21h2");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include('smb_func.inc');
include('smb_hotfixes.inc');
include('smb_hotfixes_fcheck.inc');
include('smb_reg_query.inc');

get_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');

bulletin = 'MS22-07';
kbs = make_list(
  '5015814'
);

if (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit('SMB/Registry/Enumerated');
get_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);

if (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);

share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if (
  smb_check_rollup(os:'10',
                   os_build:22000,
                   rollup_date:'07_2022',
                   bulletin:bulletin,
                   rollup_kb_list:[5015814])
)
{
  replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
}
VendorProductVersionCPE
microsoftwindows_11_21h2cpe:/o:microsoft:windows_11_21h2

References

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.702

Percentile

98.0%